5 ms·

SE Linux is enabled by default in Debian, Ubuntu, Fedora and Manjaro (iirc), so I stopped reading at the introduction. The exploit presupposes the lack of this

SE Linux is enabled by default in Debian, Ubuntu, Fedora and Manjaro (iirc), so I stopped reading at the introduction. The exploit presupposes the lack of this basic hardening.

krick 6y ago
I'm not sure how it helps here. User-level access in enough, isn't it?
- Jkvngt 6y ago
  It is.
- freeone3000 6y ago
  SELinux is more fine-grained than user-level access: it implements application-level access. Even if you, as a user, can access a file, an application working on your behalf cannot do so; same for launching applications.
  - danieldk 6y ago
    Indeed, Russell Coker even has a public demo machine (I don't know if it still works) where anyone can log in as root/uid 0, and still can't do much useful due to the SELinux policies on the machine: https://www.coker.com.au/selinux/play.html https://www.coker.com.au/selinux/play.html
danieldk 6y ago
Of those distributions, only Fedora sets SELinux to enforcing by default. Moreover, AFAIK Fedora (and RHEL) are the only distributions that had wide-scale testing of the reference policy [1] [2]. So, if you enable SELinux with the reference policy on the other distributions that you mention, it is likely that you will run into all kinds of issues. [1] https://github.com/SELinuxProject/refpolicy https://github.com/SELinuxProject/refpolicy [2] https://github.com/fedora-selinux/selinux-policy https://github.com/fedora-selinux/selinux-policy
- canofbars 6y ago
  Every day I become more and more of the opinion that Fedora/RHEL are the only distros that are actually worth using. I recently installed ubuntu server to see what it was like compared to fedora server and was shocked to see that the python package still links to python 2 (!) despite it already being officially discontinued. Fedora Silverblue/CoreOS look like a massive step in the right direction which no other mainstream distros are working on. Fedora also seems to be the only distro willing to set sane defaults for everything (SELinux, Wayland, CGroupsV2, soon to be pipewire, python 3) while every other distro waits around for someone else to make the first move.
  - deadbunny 6y ago
    > I recently installed ubuntu server to see what it was like compared to fedora server and was shocked to see that the python package still links to python 2 (!) despite it already being officially discontinued. How recently? Ubuntu 20.04 dropped python 2 completely.
    - canofbars 6y ago
      Installed it in the second quarter of 2020 but I just checked my isos folder and it looks like I have ubuntu server 19.10. Good to see python 2 finally kicked out.
lousken 6y ago
for debian and ubuntu i think you meant apparmor not selinux except for fedora they don't support selinux well

SE Linux is enabled by default in Debian, Ubuntu, Fedora and Manjaro (iirc), so I stopped reading at the introduction. The exploit presupposes the lack of this basic hardening.

krick 6y ago

I'm not sure how it helps here. User-level access in enough, isn't it?

Jkvngt 6y ago
It is.
freeone3000 6y ago
SELinux is more fine-grained than user-level access: it implements application-level access. Even if you, as a user, can access a file, an application working on your behalf cannot do so; same for launching applications.
- danieldk 6y ago
  Indeed, Russell Coker even has a public demo machine (I don't know if it still works) where anyone can log in as root/uid 0, and still can't do much useful due to the SELinux policies on the machine: https://www.coker.com.au/selinux/play.html https://www.coker.com.au/selinux/play.html

danieldk 6y ago

Of those distributions, only Fedora sets SELinux to enforcing by default. Moreover, AFAIK Fedora (and RHEL) are the only distributions that had wide-scale testing of the reference policy [1] [2]. So, if you enable SELinux with the reference policy on the other distributions that you mention, it is likely that you will run into all kinds of issues. [1] https://github.com/SELinuxProject/refpolicy https://github.com/SELinuxProject/refpolicy [2] https://github.com/fedora-selinux/selinux-policy https://github.com/fedora-selinux/selinux-policy

canofbars 6y ago
Every day I become more and more of the opinion that Fedora/RHEL are the only distros that are actually worth using. I recently installed ubuntu server to see what it was like compared to fedora server and was shocked to see that the python package still links to python 2 (!) despite it already being officially discontinued. Fedora Silverblue/CoreOS look like a massive step in the right direction which no other mainstream distros are working on. Fedora also seems to be the only distro willing to set sane defaults for everything (SELinux, Wayland, CGroupsV2, soon to be pipewire, python 3) while every other distro waits around for someone else to make the first move.
- deadbunny 6y ago
  > I recently installed ubuntu server to see what it was like compared to fedora server and was shocked to see that the python package still links to python 2 (!) despite it already being officially discontinued. How recently? Ubuntu 20.04 dropped python 2 completely.
  - canofbars 6y ago
    Installed it in the second quarter of 2020 but I just checked my isos folder and it looks like I have ubuntu server 19.10. Good to see python 2 finally kicked out.

lousken 6y ago

for debian and ubuntu i think you meant apparmor not selinux except for fedora they don't support selinux well